RFC 7672 mit Mailcow / Postfix

• aktivieren Sie DNSSEC auf Ihrer Domäne wenn das noch nicht aktiv ist
• konfigurieren Sie Ihre Emailserver richtig
• veröffent­lichen Sie TLSA-Records passend zu Ihren Zertifikaten für Ihre Emailserver

Konfiguration von Postfix

Das Tool

/opt/monque/mon.sh

#!/bin/bash

cd /opt/mailcow-dockerized
docker-compose exec -T postfix-mailcow postqueue -p >../monque/postqueue.out
docker-compose exec -T postfix-mailcow postqueue -j | tr "\n" ",\n" >../monque/postqueue.json

cd ../monque

cat postqueue.out | sed -nre 's/^([A-F0-9]+)\s+.*$/\1/p' | sort >postqueue.new
cmp postqueue.new postqueue.old
if [ $? -ne 0 ];
then
        cat prolog.js postqueue.json epilog.js | nodejs >../monque/newpolicy.txt
        ./stripdnssec.sh <newpolicy.txt >newpolicy.sql
        cat setpolicy.sql newpolicy.sql | ./setpolicy.sh
        cp postqueue.out postqueue.`date +"%m%d.%T"`
        cp postqueue.json postqueue.json.`date +"%m%d.%T"`
        echo  "From: ***@lindenberg.one" >postqueue.mail
        echo  "To: ***@lindenberg.one" >>postqueue.mail
        echo  "Subject: Queue Status" >>postqueue.mail
        echo -n "Date: ">>postqueue.mail
        date --rfc-email >>postqueue.mail
        echo  >>postqueue.mail
        cat postqueue.out >>postqueue.mail
  curl --url 'smtps://mail.lindenberg.one:465' --ssl-reqd \
  --mail-from 'noreply@lindenberg.one' --mail-rcpt '***@lindenberg.one' \
  --upload-file postqueue.mail --user 'noreply@lindenberg.one:***'
  mv postqueue.new postqueue.old
fi

/opt/monque/prolog.js

const console = require('console');

var a = [

/opt/monque/epilog.js

];
for (var r of a)
  if (r.queue_name == "deferred")
    for (var s of r.recipients)
    {
       var address = s.address;
       address = address.substring(address.indexOf('@')+1);
       var policy ='';
       switch(s.delay_reason.substring(0,36)) {
         case 'Server certificate not verified':
         case 'Server certificate not trusted':
               policy = 'encrypt'; break;
         case 'TLS is required, but was not offered':
               policy = 'may'; break;
        }
        if (policy != '') console.debug("%s,%s\n", address, policy);
    }

/opt/monque/stripdnssec.sh

#!/bin/bash

sed -e 's/,/\n/g'  | (while read d; do
  if [[ $d == "" ]] ; then
          continue
  fi
  read p;
  mx=$(dig +dnssec -t MX $d @1.1.1.1 | sed -nre 's/^.*\s+IN\s+MX\s+[0-9]+\s+(.*)\.$/\1/p')
  tlsa=$(dig +dnssec -t TLSA _25._tcp.$mx @1.1.1.1 | grep -E '\s+IN\s+TLSA\s+')
#  echo $mx, $tlsa >&2
  if [[ $tlsa != "" ]] ; then
         p='dane-only'; # good choice w/o DNSSEC
  else
    dig +dnssec -t MX $d @1.1.1.1 | grep -E '\s+IN\s+RRSIG\s+MX\s+' >/dev/null
    if  [[ $? == 0 ]] ; then
        continue # if we ever get here, then the cert was invalid and DANE unsupported
        p='verify'; # DNSSEC explicit
    fi;
  fi;
  echo  call setPolicy\(\'$d\',\'$p\'\);
done)

/opt/monque/setpolicy.sql

DELIMITER ;;

CREATE OR REPLACE PROCEDURE setPolicy (
    IN domain CHAR(255),
    IN pol CHAR(20)
)

BEGIN

update ignore tls_policy_override set active=1, policy=pol where dest = domain collate 'utf8mb4_unicode_ci';
if (ROW_COUNT() = 0) then
  insert into tls_policy_override SET dest = domain collate 'utf8mb4_unicode_ci', policy=pol, active=1;
end if;

select* from tls_policy_override;

END ;;

DELIMITER ;

/opt/monque/setpolicy.sh

cd /opt/mailcow-dockerized
source mailcow.conf
mariadb -h 127.0.0.1 --port 13306 -u ${DBNAME} -p${DBPASS} mailcow
docker-compose exec -T postfix-mailcow postqueue -f
cd /opt/monque